Revelstoke + Panther Integration

Notify analysts and SOC teams when Revelstoke observes and responds to the root of an incident.

Below are the step-by-step instructions on how to connect Panther to Revelstoke and manage this integration.\\

How It Works

Revelstoke ingests alerts if suspicious activity is detected. A new alert in Panther will trigger the creation of an alert in Revelstoke. Revelstoke allows management of the Panther alert workflow.

Requirements

The Panther integration requires an admin role in order to authorize the account. If you are not an admin, please reach out to an admin or account owner within your organization to configure the integration for you.

Support

If you need any help getting the Panther integration up and running, please do not hesitate to reach out to us via email at [email protected].

Integration Walkthrough

In Panther

Revelstoke integrates with Panther as a Custom API. To connect, you must generate an API Key.

Settings > API Tokens > Create New Token

In Revelstoke

In your Revelstoke instance, navigate to the integrations page
Select Add Integration Instance

Select the Panther integration

Enter the following required fields:
Base URL of API Platform
API Key
Results Limit

Click Save
To Remove Panther from Revelstoke
Select the Trash Can icon in the Integrations List
Select Yes, delete

Back to Resources

Revelstoke radically simplifies security orchestration, automation and response (SOAR), so security teams can work faster, smarter and more effectively. With a low-code, drag-and-drop interface, dozens of built-in integrations, incredible visibility into performance metrics, and robust reporting capabilities, Revelstoke empowers analysts to stop threats fast, and gives security leaders a clear picture on the business impact of security operations.